Cross-site scripting (XSS) attack using control sequences, SAP security note 1154828

SAP security note 1154828, "Cross-site scripting (XSS) attack using control sequences", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This SAP Security Note addresses a Cross-site scripting (XSS) vulnerability that occurs when control sequences (e.g., TAB <=> 0x09) are inserted, potentially bypassing existing filter mechanisms. In Web Dynpro for ABAP, the standard element sap-ep-themeroot can be exploited to include external JavaScript (JS) code.

• Insertion of control sequences can lead to XSS attacks.
• Example: the JS statement javascr%09ipt:alert(‘hallo’) is interpreted as javascript:alert(‘hallo’) in Internet Explorer 6 (IE6), ignoring existing filters.

Solution

• Upgrade browsers: use newer browser versions (e.g., IE7, Firefox 2) where JS code cannot be executed with control sequences. This issue is recognized as a browser error, and browser vendors are expected to address it. Reference: OWASP.
• Implement correction instructions: if upgrading browsers is not feasible, apply the attached correction instructions provided in the SAP Note. The corrections enhance filter rules to recognize control sequences in active HTML tags, mitigating the vulnerability. Note: these changes are not part of the standard SAP system and should be used as an immediate measure to protect against old browsers.

Reason and prerequisites

Affected browsers include Internet Explorer 6, Firefox 1, Netscape 8 in IE mode, and Opera 9.02. These browsers allow external code insertion by merging with control sequences.

References

• Composite SAP Note: HCM Authorizations Documentation
• Composite SAP Note: XSS Documentation
• Stricter Check in Method CL_HTTP_UTILITY=>IS_VALID_URL

Affected components

• SAP_BASIS 700 to 701
• SAP_BASIS 710 to 711